Transcript The New Standards on Quality Control and Practical

AICPA
Governmental Audit Quality Center
Member Conference Call
on
The New Standards on Quality Control
and Practical Implementation Tips
May 14, 2009
Presented by
Diane Edelstein, CPA
Maher Duessel, CPAs
&
Ahava Goldman, CPA
AICPA
What we will cover?
• Provide an overview of the requirements of Statement on Quality
Control Standards (SQCS) No. 7
• Discuss the elements of a system of quality control;
• Provide practical tips for implementing SQCS No. 7 in your
governmental audit practices;
• Brief you on the quality control requirements of Government
Auditing Standards and how they relate to SQCS No. 7; and
• Review the additional GAQC membership requirements relating to
your system of quality control and tips for implementing them.
3
Overview of
Statement on Quality Control Standards
(SQCS) No. 7,
A Firm’s System of Quality Control
(AICPA, Professional Standards, vol. 2, QC sec. 10)
4
SQCS No. 7
• Issued October 2007
• Supersedes all previous SQCSs
• Effective as of January 1, 2009
• Compliance with PCAOB QC standards does not
automatically mean compliance with SQCS 7.
5
SQCS No. 7
The firm must establish a system of quality control
designed to provide it with reasonable
assurance that:
– The firm and its personnel comply with
professional standards and applicable
regulatory and legal requirements, and
– Reports issued are appropriate in the
circumstances
6
SQCS No. 7
A system of quality control consists of:
•
Policies designed to achieve these objectives
and
• The procedures necessary to implement and
monitor compliance with those policies.
7
SQCS No. 7
Documentation and Communication
• Required to document QC policies and
procedures.
– Extent based on firm characteristics
• Required to communicate QC policies and
procedures to personnel.
– More effective if in writing, but not required to
be.
8
Elements of a System of
Quality Control
9
Required Elements of QC System
• Leadership responsibilities for quality within the
firm (the “tone at the top”)
• Relevant ethical requirements
• Acceptance and continuance of client
relationships and specific engagements
• Human resources
• Engagement performance
• Monitoring
10
Tone at the Top
Objective
Promote a
quality-oriented
internal culture
11
Tone at the Top
Policies
• Require the firm’s leadership to assume
ultimate responsibility for the QC system.
• Assign management responsibilities so
that commercial considerations do not
override the quality of work performed.
12
Tone at the Top
Policies (Cont’d)
• Assign operational responsibility to appropriate
personnel (experience, ability, authority)
• Address personnel performance evaluation,
compensation and advancement to demonstrate
the firm’s overarching commitment to quality.
• Devote resources to developing,
communicating, and supporting QC policies and
procedures.
13
Relevant Ethical Requirements
Objective
Reasonable assurance that the firm and its
personnel comply with relevant ethical
requirements.
• Independence
• Objectivity
• Integrity
14
Relevant Ethical Requirements
Policies
• Require personnel to comply with relevant
ethical requirements
• Communicate independence requirements to
personnel
• Identify and evaluate threats
• Withdraw from engagements if effective
safeguards to reduce threats to independence
acceptably cannot be applied
15
Relevant Ethical Requirements
Policies (Cont’d)
• Annually obtain written confirmation from
all personnel required to be independent
• Confirm independence of another firm
who performs part of the engagement
• Rotate personnel for audits or attest
engagements where required by
regulation
16
Acceptance and Continuance of
Client Relationships and Specific Engagements
Objective - Firm should undertake or continue
relationships and engagements only where it:
•
Has considered the integrity of the client and the risks associated
with providing professional services in the particular circumstances.
•
Is competent to perform the engagement and has the capabilities and
resources to do so.
•
Can comply with legal and ethical requirements.
•
Has reached an understanding with the client regarding the services
to be performed.
17
Acceptance and Continuance of
Client Relationships and Specific Engagements
Policies
• Evaluate management’s integrity and consider
risks of engagement
• Evaluate whether engagement can be
performed with professional competence;
undertake only those engagements firm has
capabilities, resources and competence to
perform; and periodically evaluate whether
relationship should be continued
18
Acceptance and Continuance of
Client Relationships and Specific Engagements
Policies (Cont’d)
• Obtain an understanding with the client
regarding the services to be performed,
preferably in writing.
• Establish procedures on withdrawal from an
engagement or from both the engagement and
the client relationship
• Document how issues were resolved.
19
Human Resources
Objective
Reasonable assurance of sufficient personnel with
the necessary capabilities, competence and
commitment to ethical principles to perform the
engagements and enable the firms to issue
appropriate reports.
20
Human Resources
Policies and procedures should address:
– Recruitment and hiring, if applicable;
– Determining capabilities and competencies;
– Assigning personnel to engagements, if
applicable;
– Professional development; and
– Performance evaluation, compensation and
advancement.
21
Engagement Performance
Objectives
Engagements are consistently performed in
accordance with professional standards
and regulatory and legal requirements, and
the firm or the engagement partner issues
reports that are appropriate in the
circumstances.
22
Engagement Performance
Policies
• Plan all engagements to meet professional, regulatory,
and the firm’s requirements.
• Perform work and issue reports and other
communications that meet professional, regulatory, and
the firm’s requirements.
• Require that work performed by other team members be
reviewed by qualified engagement team members,
which may include the engagement partner, on a timely
basis.
23
Engagement Performance
Detailed guidance on
• Engagement performance (plan and execute)
• Supervision responsibilities
• Review responsibilities
• Engagement documentation
• Consultation policies and procedures
• Resolution of differences of opinions, including a
requirement that reports not be released until the
differences of opinions are resolved.
24
Planning Procedures
• Assign engagement team
• Update client information and obtain engagement letter
• Prepare planning document
– Work programs tailored to engagement
– Staffing requirements and need for specialized knowledge
– Risk assessment – economic conditions and fraud
considerations
– Budget with sufficient time
25
Supervision Procedures
•
Tracking the progress of the engagement;
•
Considering the capabilities and competence of individual members
of the engagement team, whether they have sufficient time to carry
out their work, whether they understand their instructions, and
whether the work is being carried out in accordance with the
planned approach to the engagement;
•
Addressing significant issues arising during the engagement,
considering their significance, and appropriately modifying the
planned approach; and
•
Identifying matters for consultation or consideration by moreexperienced engagement team members during the engagement.
26
Review Responsibilities Policies
Determined on the basis that qualified
engagement team members, which may
include the engagement partner, review
work performed by other team members
on a timely basis.
27
Review Checklist
•
Has the work been performed in accordance with professional standards
and regulatory and legal requirements?
•
Have significant findings and issues been raised for further consideration?
•
Have appropriate consultations taken place and have the resulting
conclusions have been documented and implemented?
•
Is the nature, timing, and extent of work performed appropriate and without
need for revision?
•
Does the work performed support the conclusions reached and is it
appropriately documented?
•
Is the evidence obtained sufficient and appropriate to support the report?
•
Have the objectives of the engagement procedures been achieved?
28
Engagement Documentation Policies
• Require the engagement team to complete the
assembly of final engagement files on a timely basis.
• Establish procedures to maintain the confidentiality, safe
custody, integrity, accessibility, and retrievability of
engagement documentation.
• Require the retention of engagement documentation for
a period of time sufficient to meet the needs of the firm,
professional standards, laws, and regulations.
29
Consultation Policies
• Consultation takes place when appropriate (for example,
when dealing with complex, unusual, unfamiliar, difficult,
or contentious issues)
• Sufficient and appropriate resources are available to
enable appropriate consultation to take place
• All the relevant facts known to the engagement team are
provided to those consulted
• The nature, scope, and conclusions of such
consultations are documented
• The conclusions resulting from such consultations are
implemented
30
Differences of Opinion - Policies
Within the engagement team, with those
consulted, and between the engagement
partner and engagement quality control
reviewer
• Conclusions reached are documented and
implemented
• The report is not released until the matter is
resolved
31
Engagement Quality Control Review (EQCR)
• Establish criteria for determining whether an
engagement quality control review should be performed,
• Evaluate all engagements against the criteria
• Perform an engagement quality control review for all
engagements that meet the criteria, and complete the
review before the report is released.
• Establish procedures addressing the nature, timing,
extent and documentation of the engagement quality
control review.
32
EQCR - Procedures
•
•
•
•
•
An objective evaluation of the significant judgments made by the
engagement team, and the conclusions reached in formulating the
report.
Reading the financial statements or other subject matter information
and the report, and consideration of whether the report is
appropriate.
Review of selected engagement documentation relating to the
significant judgments the engagement team made and the
conclusions they reached
Discussion with the engagement partner regarding significant
findings and issues.
Extent depends on the complexity of the engagement and the risk
that the report might not be appropriate in the circumstances.
33
Monitoring
Objective – reasonable assurance that QC
policies and procedures are
• Relevant
• Adequate
• Operating effectively
• Complied with in practice
34
Monitoring - Requirements
• Ongoing evaluation of appropriateness of
design and operating effectiveness
• Assign responsibility for the monitoring process
to a partner.
• Assign performance of the monitoring process
to competent individuals.
• Perform sufficiently comprehensive procedures.
35
Monitoring Procedures
– Review of selected administrative and personnel
records pertaining to the quality control elements
– Review of engagement working papers, reports, and
clients' financial statements
– Discussions with the firm's personnel
– Summarization of the findings from the monitoring
procedures, at least annually, and consideration of
the systemic causes of findings that indicate that
improvements are needed
36
Monitoring Procedures cont’d
– Determination of any corrective actions to be taken or
improvements to be made with respect to the specific
engagements reviewed or the firm's quality control
policies and procedures
– Communication of the identified findings to
appropriate firm management personnel
– Consideration of findings by appropriate firm
management personnel who should also determine
that any actions necessary, including necessary
modifications to the quality control system, are taken
on a timely basis
37
Monitoring Procedures cont’d
•
Assessment of
– The appropriateness of the firm’s guidance materials and any practice
aids;
– New developments in professional standards and regulatory and legal
requirements and how they are reflected in the firm’s policies and
procedures where appropriate;
– Compliance with policies and procedures on independence;
– The effectiveness of continuing professional development, including
training;
– Decisions related to acceptance and continuance of client relationships
and specific engagements; and
– Firm personnel’s understanding of the firm’s quality control policies and
procedures and implementation thereof.
38
Monitoring
Monitoring procedures may be accomplished
through the performance of:
• Engagement quality control review
• Post-issuance review of engagement working
papers, reports, and clients’ financial statements
for selected engagements
• Inspection procedures
39
Monitoring
Self-inspection
• Not prohibited
• Higher risk that noncompliance with
policies and procedures will not be
detected
40
Monitoring - Communication
To engagement partners and others:
•
Deficiencies noted as a result of the monitoring
process
•
Recommendations for appropriate remedial
action.
To all relevant personnel:
•
Monitoring results at least annually.
41
Monitoring
• Procedures to deal appropriately with
complaints and allegations
– Clear channels for personnel to raise
concerns without fear of reprisal
– Documentation of complaints and responses
42
Monitoring - Documentation
• Document evidence of the operation of each
element of its system of quality control.
– Form and content based on firm
characteristics
• Retain this documentation for a period of time
sufficient to permit those performing monitoring
procedures and peer review to evaluate the
firm’s compliance.
43
SQCS No. 7 - Practice Aid
AICPA Audit and Accounting Practice Aid
Series:
Establishing and Maintaining a System of Quality
Control for a CPA Firm’s Accounting and Auditing
Practice
Available at
http://www.aicpa.org/download/members/div/audits
td/System_of_Quality_Control_Practice_Aid.pdf
44
Practical Tips for
Implementing SQCS No. 7
45
Tips for Implementing SQCS No. 7
• Do you update your current Quality
Control document or start over?
• It is important to remember that your
Quality Control Document is fluid
– Improving your document is ongoing.
– Keep prior versions with noted effective dates.
46
Tips for Implementing SQCS No. 7
• Areas we struggled with:
– Engagement quality review criteria.
– EQCR reviewer being independent to the
engagement.
– Acceptance and continuation of client
relationship documentation.
– Complaints and allegations.
47
Additional Quality Control
Requirements of Government
Auditing Standards
48
Yellow Book QC Requirements
• July 2007 Revisions to Yellow Book
– Supersedes the Jan. 2007 and 2003 revisions
– Enhanced and clarified the requirements for
an audit organization’s system of quality
control by specifying the elements of quality
that an organization’s policies and procedures
collectively address
– Added a requirement that external audit
organizations make their most recent peer
review report publicly available
49
Yellow Book QC Requirements
• Paragraph 3.50 – 3.54 discuss QC
Requirements
• Requirements for system of quality control are
consistent with the AICPA proposed statement
on Quality Control Standards except that the
GAGAS requirements state that reviews of the
work and the report that are normally part of
supervision are not monitoring controls when
used alone
50
Yellow Book QC Requirements
• Those audit organizations seeking to enter into a
contract to perform a GAGAS audit or attestation
engagement should provide the following to the party
contracting for such services
– The audit organization’s most recent peer review
report and any letter of comment
– Any subsequent peer review reports and letters of
comment received during the period of the contract
• Auditors who are using another audit organization’s
work should request
– The audit organization’s latest peer review report
– Any letter of comment
51
Yellow Book QC Requirements
• Must document & communicate
• Policies must address:
– Leadership Responsibilities
– Independence, Legal & Ethical Requirements
– Initiation, Acceptance and Continuance of
Engagements
– Human Resources
– Engagement performance, documentation and
reporting
– Monitoring
52
Yellow Book QC Requirements
• Monitoring:
– Purpose:
• Ensure adherence to requirements
• Ensure QC is appropriately designed
• Ensure QC policies & procedures are operating
effectively
53
Yellow Book QC Requirements
• Monitoring:
– Engagement Supervision Alone is not Monitoring
– Audit organizations to analyze and summarize the
results of monitoring procedures at least annually
• Include identification of any systemic issues
needing improvement
• Include recommendations for corrective action
– Should be performed by individuals that collectively
have sufficient expertise and authority
54
Additional GAQC Membership
Requirements Relating to your
System of Quality Control
55
GAQC Membership Requirements
• Policies & Procedures:
– GAQC Policies to be Addressed in QC
Document
•
•
•
•
•
•
Identify Designated Partner
Client Acceptance and Retention
Engagement Performance and Review
Training and Supervision
Internal Inspection
Peer Review
56
GAQC Membership Requirements
• Policies & Procedures con’t:
– Methods of documenting:
• Revise the firm’s QC document to address the
governmental audit practice to comply with
applicable professional standards and Center
membership requirements.
• Prepare an addendum to the firm’s existing QC
Document
57
GAQC Membership Requirements
• Policies & Procedures con’t:
– Communicate
• Circulate the revised firm QC document
• Establish training to inform audit staff of the firm’s
QC policies and procedures
• Circulate communication to audit staff regarding
the firm’s QC policies and procedures
• Link to QC document on the firm’s intranet
58
GAQC Membership Requirements
• Annual Internal Inspections:
– Required to establish annual internal inspection procedures that
include a review of the firm's governmental audit practice (that is,
all audits performed under Government Auditing Standards)
– Reviewer should have current experience & knowledge of
governmental auditing and accounting practices
– Engagements inspected should be representative of the firm’s
governmental audit practice (e.g., single audits, program-specific
audits, HUD audits, etc.) and the firm locations those audits are
performed in
– Inspection results should be made available to peer reviewer
59
GAQC Membership Requirements
• Annual Internal Inspections con’t:
– Firm’s monitoring process should Include a review of
the firm’s compliance with GAQC membership
requirements
– A peer review is not a substitute for monitoring
procedures
– However, consistent with AICPA quality control
standards, the peer review may substitute for some or
all of its inspection procedures for the period covered
by the peer review.
60
GAQC Membership Requirements
• Annual Internal Inspections con’t:
– Developing an Governmental Audit Practice Self-Inspection
Strategy
• Begin with the inventory of your governmental audits audits
(that is, all performed under Government Auditing Standards)
• Consider:
–
–
–
–
–
–
When is the best time of year to conduct this review?
Who should perform the review?
How long will it take?
How are we going to communicate the results?
What about multi-office issues?
How it differs from concurring partner reviews?
• Obtain AICPA peer review checklist or develop firm checklist
61
GAQC Membership Requirements
•
•
•
•
•
•
DAQP - Designating an audit partner to have firm-wide responsibility for the
quality of the firm's governmental audit practice.
Having all audit partners of the firm residing in the United States and eligible
for AICPA membership be members of the AICPA.
Ensuring that the DAQP meets the yellow book CPE requirements, even if
that partner would not otherwise be subject to those CPE requirements.
DAQP must participate in an annual Center-sponsored Webcast on recent
developments in governmental auditing.
Making publicly available information about the firm’s most recently
accepted peer review as determined by the Executive Committee.
Having firm’s governmental audits selected as part of the firms peer review
reviewed by a peer review team member who is employed by a Center
member firm.
62
GAQC Membership Requirements
• Use the Q&A document on GAQC membership
requirements located at:
http://gaqc.aicpa.org/Memberships/Q+and+A+Me
mbership+Requirements.htm
(Note: This document is being updated for SQCS 7
however, it currently contains very useful and relevant
information about GAQC membership requirements.)
63
Questions ?????
64